sppmig.dll

SPP migration plug-in DLL file version info

Library on Windows 3 known copies with hashes

Is it the real sppmig.dll?

file version info and known copies

Installed inC:\Windows\system32\migration\
C:\Windows\system32\migwiz\replacementmanifests\SppMig\
C:\Windows\SysWOW64\migration\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionSPP migration plug-in DLL

3 known copies

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\migwiz\replacementmanifests\SppMig\SppMig.dll · signed by Microsoft Windows

59f27e59622ffe206d4937533a25a46b20f7cfbc4026936a6a5c7982f6c97424

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\migration\sppmig.dll · signed by Microsoft Windows

5ec36ac0ca0cbedc1c20100585f1c4f1abf48331e4fc2e50225f8cf3a7ceb515

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\migration\sppmig.dll · signed by Microsoft Windows

d3a4418418f10562f67d8fc194904505bc77355208a60a98ff8c6ea65e0e75d6

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.